The ongoing campaign targeting ConnectWise ScreenConnect deployments involves the exploitation of a now-patched critical security flaw in the remote access software, and not a new vulnerability, it has emerged. Blackpoint Cyber's Adversary Pursuit Group (APG), which shared the details with The Hacker News, said the recovered attacker toolkit exploits CVE-2026-84869 (CVSS score: 9.9), an
SCKit Malware Turns ScreenConnect Support Sessions Into Potential MSP Attack Paths
About this summary. This is a short excerpt from the description that The Hacker News published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://thehackernews.com/2026/11/sckit-malware-targets-screenconnect.html
Source attribution: headline and facts are from The Hacker News (thehackernews.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Rogue remote-access campaign spread through ScreenConnect add-on, researchers say
Security researchers at Huntress said an intruder used access to multiple cloud-hosted ScreenConnect panels Wednesday to push commands to groups of managed endpoints…
Hackers Deploy Malware in Fresh ScreenConnect Campaign
The attackers exploited a vulnerability in a legitimate extension to bypass ScreenConnect authentication.
ConnectWise Cloud Backup Breach: What We Know
ConnectWise is investigating unauthorized access to application identities associated with Cloud Backup, formerly SkyKick, after researchers detected the applications…
New N-able "4EverAble2Shell" zero-day exploited hours after PoC released
Hackers are actively exploiting a newly disclosed N-able N-central zero-day vulnerability dubbed "4EverAble2Shell" to compromise servers and deploy cryptocurrency…
Apache HTTP Server patches critical HTTP/2 remote code execution flaw
A critical vulnerability in the HTTP/2 module of Apache HTTP Server could be exploited by an unauthenticated attacker to obtain remote code execution (RCE).
Check Point security advisory (AV26-1154)
Serial number: AV26-1154 Date: November 12, 2026 As of November 12, 2026, Check Point is affected by vulnerabilities in the following products: Check Point Force…